Data Protection & Technical Security

HalalKnot uses hosted infrastructure supplied by Vercel and Supabase. These services provide controls that support availability and separation of application data, but no online service can eliminate all risk.

• Frontend & Edge: Hosted on Vercel. Supported browser connections use HTTPS/TLS while data is transmitted.
• Backend & Database: Powered by Supabase (PostgreSQL). Our configured project region is AWS EU-West-1 (Ireland). Regional hosting supports our data-protection approach but does not, by itself, establish GDPR compliance.

HalalKnot does not collect explicit religion or sect fields — no such input fields exist in the system. However, because HalalKnot is a Muslim matrimonial service, your membership and the values-related information you provide may indicate your religious beliefs, which is special-category data under GDPR Article 9. We process it only on the basis of the explicit consent you provide at sign-up, and you may withdraw that consent at any time by deleting your account.

Profile photos are processed for content moderation purposes only (see §4 below). Photos are not used for facial recognition or biometric identification, and are not retained by our moderation provider beyond the automated screening request.

We maintain active DPAs with our primary sub-processors to ensure they adhere to EU privacy standards:

• Supabase, Inc: Handles database storage, authentication, and file storage. Data stored in AWS EU-West-1 (Ireland).
• Vercel, Inc: Handles frontend hosting, edge functions, and analytics.
• Sightengine: Automated content moderation of profile photos. Photos are submitted for screening on upload; results are returned and photos are not stored by Sightengine beyond the request.
• Resend: Transactional email delivery (connection notifications, account emails). Governed by SCCs for data transferred outside the EU.

• User-Initiated Deletion: When a user clicks "Delete Account," a "Hard Delete" is triggered. Supabase RLS and Foreign Key constraints ensure all associated active private contact information and profile content are removed from the live service. A random profile identifier and deletion timestamp remain as a non-reusable tombstone for shared links.
• Backup Retention: Database backups are kept for 30 days for disaster recovery, after which they are permanently overwritten.
• Safety and anti-abuse records: A one-way email hash is retained for 30 days after voluntary deletion. Reports, moderation records and longer restrictions associated with banned accounts may be kept where necessary to investigate abuse, protect members, establish legal claims or prevent ban evasion. Access is restricted to authorised administrators.

In the event of a suspected data breach:

• Identification: Our team will be alerted via Supabase/Vercel monitoring logs.
• Assessment: Within 24 hours, we will determine the scope of the impact.
• Notification: If the breach poses a risk to users, we will notify the Irish Data Protection Commission (DPC) and affected users within 72 hours, as required by GDPR Articles 33 and 34.